---
id: "CVE-2026-95613"
page: "https://infrastack.ai/live/CVE-2026-95613"
kind: "vulnerability"
aliases: ["CVE-2026-95613"]
title: "Zenitel Connect: forged tokens grant PostgreSQL superuser access via pREST API"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "postgresql", "prest", "zenitel-connect"]
not_affected_if: ["firmware-1.11.0-or-later"]
published_at: "2026-11-13T16:19:38+00:00"
first_seen_at: "2026-11-13T16:47:35+00:00"
updated_at: "2026-11-13T16:48:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95613", "first_seen_at": "2026-11-13T16:47:35+00:00"}]
exploit_sources: []
---

# Zenitel Connect: forged tokens grant PostgreSQL superuser access via pREST API

Link for people: https://infrastack.ai/live/CVE-2026-95613 (this .md is for agents)

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and checks JSON Web Tokens with the platform CA private key, which sits on a volume shared between containers. An attacker who reads that key can forge a token naming the postgres superuser and run database operations as it, including reading the master encryption key and password hashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Zenitel Connect firmware version on the device or in its admin interface; versions before `1.11.0` are affected.
- Look for the pREST API service in the Connect platform containers and confirm whether the shared data volume holds the platform CA private key.

## Fix

- Zenitel Connect firmware: move to `1.11.0` or later.

## Timeline

- 2026-11-13T16:47:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95613

## From the sources

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_